import json

from flask import Flask
from sqlalchemy import create_engine
from sqlalchemy.orm import Session

from app.api.auth import auth_bp
from app.db import Base, create_session_factory
from app.services.identity import IdentityRepository, PasswordService


def make_auth_app():
    engine = create_engine("sqlite+pysqlite:///:memory:")
    Base.metadata.create_all(engine)
    session_factory = create_session_factory(engine)

    app = Flask(__name__)
    app.config.update(TESTING=True, SECRET_KEY="test-secret", SESSION_COOKIE_SECURE=False)
    app.extensions["crowdsight_session_factory"] = session_factory
    app.register_blueprint(auth_bp, url_prefix="/api/auth")

    with session_factory() as session:
        repo = IdentityRepository(session)
        org = repo.create_organization(name="Org A", slug="org-a")
        user = repo.create_user(
            email="admin@example.com",
            password_hash=PasswordService.hash_password("correct horse battery staple"),
        )
        repo.create_membership(user.id, org.id, "admin")
        session.commit()

    return app, engine


def _csrf_headers(client):
    return {"X-CSRF-Token": client.get_cookie("crowdsight_csrf").value}


def test_login_me_logout_uses_cookie_and_allowlisted_identity():
    app, engine = make_auth_app()
    try:
        client = app.test_client()
        login = client.post(
            "/api/auth/login",
            json={"email": "ADMIN@example.com", "password": "correct horse battery staple"},
        )
        assert login.status_code == 200
        body = login.get_json()
        assert body["success"] is True
        assert body["data"]["user"]["email"] == "admin@example.com"
        assert body["data"]["role"] == "admin"
        assert body["data"]["organization"]["slug"] == "org-a"
        assert "token" not in json.dumps(body)
        assert "password" not in json.dumps(body).lower()

        me = client.get("/api/auth/me")
        assert me.status_code == 200
        assert me.get_json()["data"]["user"]["id"]

        logout = client.post("/api/auth/logout", headers=_csrf_headers(client))
        assert logout.status_code == 200
        assert client.get("/api/auth/me").status_code == 401
    finally:
        engine.dispose()


def test_invalid_credentials_return_structured_generic_error():
    app, engine = make_auth_app()
    try:
        response = app.test_client().post(
            "/api/auth/login",
            json={"email": "admin@example.com", "password": "wrong password"},
        )
        assert response.status_code == 401
        body = response.get_json()
        assert body["success"] is False
        assert body["error_code"] == "invalid_credentials"
        assert "error" not in body
        assert "Traceback" not in json.dumps(body)
    finally:
        engine.dispose()